Compliance that gets done, not just tracked.

Most compliance platforms track the work: the dashboard shows what's missing and a person goes and does it. Screenata's agent does the work. Vera scans your infrastructure, composes policies from what's real, collects evidence, runs scheduled checks at 6 AM, and delivers everything through Slack, email, GitHub, and your terminal. And where evidence comes from is different: every platform reconstructs it after the work; we're building the one where the work produces it.

Yes. Daily 6:00 AM evidence freshness checks, daily 6:15 AM readiness snapshots, weekly Monday cloud and code scans, and annual risk refreshes all run on scheduled jobs; quarterly access reviews are scheduled and orchestrated by Vera, with a human certifying each one. Vera flags stale evidence, drafts delegation messages, scopes remediation, and posts agent reports. You approve actions; you don't run them.

Screenata scans first, then writes. We pull context from GitHub, AWS or GCP, your IdP, existing evidence, and your company profile, then generate policies grounded in what we found. The overpromise checker flags hard commitments (like 'quarterly access reviews') we cannot verify in evidence, before you ever ship them to an auditor.

Yes. Each claim in a policy is anchored to a specific sentence and linked to the control test that verifies it. Each test has its evidence submissions, and each submission references a cryptographically signed artifact. An auditor can hover any claim in a policy, see the test that proves it, and verify the evidence package independently with a signed manifest.

Evidence exports are tamper-evident: SHA-256 per-file hashes, RSA or ECDSA digital signatures, RFC 3161 independent timestamps, and BYOK support so enterprises can sign with their own keys. We're publishing the format as an open spec with a free verify CLI so anyone can check a Screenata pack without an account.

Three channels, not one. API scans cover about 30–40% of a SOC 2 across cloud, code, and identity providers. The browser extension captures screenshots of settings pages and workflows, redacts sensitive fields, runs a vision quality check, signs the capture, and re-captures it on a schedule. Guided procedures walk a teammate through steps like a backup restore test and record results and attachments as they work. Most platforms only offer the first channel and hand the rest back to you as a to-do list.

For a company under 50 employees, year one to a SOC 2 Type II runs $22–33K with Screenata, $73–81K in spreadsheets done yourself, $49–70K on Vanta or Drata done yourself, and $42–178K on Vanta or Drata with a vCISO, counting the auditor, the platform, any consultant, and your team's time at $150/hr. The auditor fee is the same on every path, and you choose and pay the auditor directly. Spreadsheets save the licence and cost more than it in hours: your team builds the tracker, gathers every artifact by hand, and re-checks every control each month because nothing monitors it.

No. Every test explains what to provide, which evidence items are required, and how your auditor will judge it, and you can ask Vera about any requirement in plain language. The lineage view traces a policy, claim, control, or test through to the evidence that proves it, so you can see why something is required. When a check fails, it comes with the recommended fix and the steps to apply it, and the finding closes on its own once the nightly re-check passes.

No. A single test maps to controls in every framework it satisfies, so evidence collected once counts toward SOC 2, HIPAA, and ISO 27001 at the same time. The controls view shows what else each test satisfies, so you can see the reuse instead of taking it on faith.

Yes. Files dropped in Slack are saved as evidence and matched to the tests they support, and escalations and SLA alerts post to Slack. You can also email your workspace address: attachments are filed as evidence and Vera replies. The dashboard is there for auditors and deep dives; day-to-day requests get done where your team already works.

Yes. Every artifact is mapped to specific Trust Services Criteria or HIPAA safeguards, signed with SHA-256 + RFC 3161 timestamps, and traceable from policy claim → control test → submission → vault artifact. Auditors get a structured pack, not a folder of screenshots, and can verify integrity independently with a free CLI. We design the output for what auditors actually look for in fieldwork: completeness, attribution, freshness, and tamper evidence.

Yes, Screenata is built to make your practice more profitable, not to replace it. vCISO firms resell or refer Screenata to their clients. Vera absorbs the policy writing, evidence chasing, and status reporting that eats 60% of your hours, so you can take on 3x the clients at the same headcount while keeping the advisory relationship and the margin. You get a firm-admin account across your client tenants. See screenata.com/for-vcisos for the partner program.

SOC 2, HIPAA, ISO 27001, ISO 42001, and GDPR. Our control model uses a shared canonical catalog so a single MFA scan satisfies SOC 2 CC6.1 and HIPAA §164.312(d) at the same time, and the same scan maps across the other frameworks you run. You collect evidence once instead of paying for each framework separately.